Data Recovery with Knoppix

Posted 18 June 2007 - 07:39 PM

mrboarderman

InsanelyMac Protégé

Just Joined

3 posts

This past Thursday my MacBook internal hard drive failed on me. While it needed to be replaced, the Apple Store Genius working with it saved my files and backed them up on my large external hard drive I have.

HOWEVER, that night my external drive (a 500GB Seagate drive in a Vantec Nexstar 3 enclosure) didn't connect when I placed the USB cable into my MacBook. Instead an ominous blinking came from the LED on the enclosure and on the AC adapter. As you may guess my hard drive would not mount in Mac OS X.

Since that day, I have been furiously scowering the web for an answer. While the data isn't important enough that I search for a company that will retrieve it for me, the data is a considerable amount of media that has taken countless hours of compiling.

My question(s) for this post is quite broad, but I am wondering what to expect as I set out in search for my missing data through the Knoppix Live CD. What sort of command may I need to use to boot my USB External drive? Can I even use the enclosure, or should I boot Knoppix on a desktop that I can use the SATA connection? Are there any problems that anyone has run into while attempting to recover data?

Anyway, my search turned up a consistant result, Linux, specifically Knoppix. I am unfamiliar with Linux, but am confortable enough with my computer skills that I could use it.

Posted 18 June 2007 - 08:49 PM

johnniecarcinogen

Yellow Box

Gurus

746 posts

Gender:Male

Rather than knoppix, i suggest downloading gparted - it uses grub 2.0 which supports EFI and works on macs I hear. Burn the disc, and boot from the disc while the external drive is plugged in. When the gparted menu comes up, it will give you options to boot the cd or the various drives/partions on the PC. Try choosing the USB drive to boot.

EDIT:

After actually reading your post I see i misunderstood =p. You just want to access the files from the external usb HD from a pc right?

Boot knoppix from the cd and if the drive doesn't show up in places>computer (or whatever KDE uses) you will have to mount it manually. If it does show up but you cant access it unmount it by right clicking on it and unmount.

manual mount:

First you will have to be the super user, just open the terminal and type:

su

Next we need to know the drive asignment, (still in the terminal):

fdisk -l

Then make a place to mount the drive:

mkdir /media/macusb

then mount the drive:

mount -t hfsplus /dev/sda1 /media/macusb

change dev/sda1 to whatever the usb drive showed as in fdisk.

Then you will be able to access the drive through Konquerer by going up to the root, then media, macusb

If you have permission problems you might have to change the permissions (from the terminal):

Posted 08 October 2009 - 10:25 PM

joeman

InsanelyMac Protégé

Just Joined

2 posts

Hi, I'm trying to recover files from a Mac drive using Knoppix. The drive mounts automatically and I'm able to browse the hard drive, but the folder I want to recover is locked. Is there any way to unlock the folder I want?
It's a crashed hard drive, so I don't know how many more spins I'm going to get out of it, so a "guaranteed" solution would be best. My knowledge of Knoppix and Mac is quite low, so detailed explanations are appreciated. Thanks.

Posted 09 October 2009 - 04:33 AM

srs5694

InsanelyMac Legend

Members

541 posts

Gender:Male

Location:Woonsocket, RI

Hi, I'm trying to recover files from a Mac drive using Knoppix. The drive mounts automatically and I'm able to browse the hard drive, but the folder I want to recover is locked. Is there any way to unlock the folder I want?It's a crashed hard drive, so I don't know how many more spins I'm going to get out of it, so a "guaranteed" solution would be best. My knowledge of Knoppix and Mac is quite low, so detailed explanations are appreciated. Thanks.

One option is to do a raw low-level copy of the partition. You'll need a free space that's at least as large as the partition you're trying to copy, though. For the sake of argument, suppose you want to back up /dev/sda1 and you have enough free space on /dev/sdb2. The Linux commands to do this would be:

Note that you'll have to issue these commands as root. If you get "permission denied" errors or something similar, add "sudo" to the start of each one, or precede them all with an "su" command.

You'd change /mnt/whatever to an appropriate mount point, and of course change /dev/sda1 and /dev/sdb2 to your real partition identifiers. Note that /dev/sdb2 will have to be formatted using a filesystem that Knoppix understands, and if /dev/sda1 holds OS X data, then presumably Mac OS should understand /dev/sdb2's filesystem, too. Unfortunately, although FAT seems to fit the bill, FAT has file-size limits that make it unsuitable for this task unless the partition in question is pretty small (4GB or smaller, IIRC -- or maybe it's just 2GB). Some Linux implementations can read/write HFS+, but I don't know what Knoppix's capabilities are in this respect. NTFS is another possibility, but you'll need to find a Linux emergency disk that can write to it. I believe that System Resuce CD and/or PartedMagic can do so. (Under OS X, you can copy the data out using OS X's standard read-only NTFS support.)

Once you've booted back into OS X, you should be able to mount the backup image (backup.img in the preceding example) like any other disk image -- just double-click it and it should mount on the desktop. You'll then be able to transfer the files at your leisure using OS X rather than Linux.

Posted 09 October 2009 - 07:18 PM

srs5694

InsanelyMac Legend

Members

541 posts

Gender:Male

Location:Woonsocket, RI

So with the raw low-level copy, is there any way to just get one folder rather than making an image of the entire partition?

No. I suggested the low-level copy because you said your disk is misbehaving and you're afraid to shut it down for fear it will be inaccessible when you reboot. Doing a low-level copy like this ensures that you'll be able to test different access methods, if necessary, to recover your files, without fear of having the drive die on you.

From Linux, my only suggestion for getting around the problem you identified is to ensure that you're running as root when you make your copy; however, that's far from the guaranteed solution you wanted.

Posted 25 April 2010 - 08:15 AM

mushroomboy

InsanelyMac Protégé

Just Joined

8 posts

First off, what FS is the external? If it's HFS+? Details details! I wouldn't want to do a dd to another disc, considering you'd have to DD the entire HDD. That complicates things because you need a hdd larger than the one your going to dd. And as for the read/write hfs+ it all blows. I know, because I've been trying to get full perms on a up to date debian system. No luck.

[edit] Oh and with dd, if the files are locked due to corrupt properties.... Well you aren't going to get those files back with DD, since it reads bit for bit your .img will also have that file locked. Oh bummer.

So where do we start? That's a good question, since if your in linux and the file is locked you won't be able to do jack. Why? Well it's hard as hell to get read/write for hfs+ on nix, and as far as that goes Mac is unix which means the file properties are unix which means linux understands that. What does that mean? Locked file in Unix = Locked file in Linux. You get the idea? Your going to have to google how to mount hfs+ read, best bet is Ubuntu live CD.

That's just my 2 cents on this, he's got to figure out read/write with HFS+ in something like Ubuntu. Now I'm just going to say, I'm pretty sure that he's going to have to install a distro to do all this.